build(deps): bump rmcp from 3.1.4 to 3.2.0 - #86
Conversation
Bumps [rmcp](https://github.com/modelcontextprotocol/rust-sdk) from 3.1.4 to 3.2.0. - [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml) - [Commits](modelcontextprotocol/rust-sdk@rmcp-v3.1.4...rmcp-v3.2.0) --- updated-dependencies: - dependency-name: rmcp dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![revuto-review[bot]](https://avatars.githubusercontent.com/u/55848801?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is an auto review done by revuto.
This lockfile-only bump is not a no-op for this crate’s stdio MCP handshake.
rmcp 3.2.0 changed initialize negotiation (modelcontextprotocol/rust-sdk#1228): any initialize request is treated as a legacy client. Requesting 2026-07-28 no longer echoes that version; the server falls back to the newest handshake version (2025-11-25).
That is the path this binary actually serves (AgentWorkspaceLinux::serve(rmcp::transport::stdio())), and it is exactly what tools_list_result / tools_list_sets_required_cache_metadata assert today. CI’s “Rust and script checks” job is red on this head and was green on main.
Do not merge the bump without either updating the handshake tests (and any host docs that assume initialize can select 2026-07-28) or pinning 3.1.4 until that work lands.
|
Confirmed. rmcp 3.2.0 changes the initialize negotiation and breaks this server’s 2026-07-28 MCP handshake and cache-metadata contract, with the repository test failing on the Dependabot head. This needs a deliberate protocol migration and updated host documentation, not a lockfile-only bump. I am keeping rmcp 3.1.4 and closing this PR. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps rmcp from 3.1.4 to 3.2.0.
Release notes
Sourced from rmcp's releases.
Commits
51ccb42chore: release v3.2.0 (#1227)ad9832efix: keep initialize on legacy protocol versions (#1228)4e74499feat(auth): coordinate OAuth refreshes through credential stores (#1232)3a2ebbcchore(deps): bump taiki-e/install-action from 2.85.13 to 2.86.7 (#1230)1afde5bdocs: use auto lifecycle in HTTP example (#1187)ec041b7ci: reduce dependabot update noise (#1184)3ef34e6feat: add request-state key rotation (#1128)12db028ci: pin release-plz fork revision (#1221)c8bb1c6ci: remove coverage job write permission (#1219)3501f3eci: default workflow tokens to read-only contents (#1218)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)